JP2007072539A - Ip multicast delivery authentication charging system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform user authentication and accounting without disclosing secret information even in a case where a network provider and a content provider are different agents in multicast delivery. <P>SOLUTION: A user device transmits an authentication request containing UID (user identifier) and CHID (channel identifier) to a CP (content provider)-AAA (authentication, authorization and accounting) server, and the CP-AAA server generates SID (session identifier) when the authentication request is permitted, and transmits a delivery request containing the UID, the SID and the CHID to a NP (network provider)-AAA server. The NP-AAA server retrieves, upon receipt of the delivery request from the CP-AAA, a user database based on the UID to acquire IFID (interface identifier) for storing the user device, and performs delivery setting of CHID to an interface of a user storage router shown by the IFID. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an authentication / billing system for IP multicast distribution that realizes authentication and accounting in multicast distribution using an IP network.

  As techniques for performing multicast control based on user authentication in multicast distribution using a conventional IP network, “IP multicast authentication method, IP multicast authentication system using the same, and program and storage medium thereof” (Patent) This conventional system includes a user authentication server having user authentication means, a customer data server having user data management means, a router control server having router control means, a user accommodating router, and group management if necessary. And a group management server having means.

In this conventional system, the user requests authentication from the user authentication server, the user authentication server authenticates by referring to the user data of the customer data server, and if the authentication is successful, the user passes through the router control server. Multicast control is realized by controlling the accommodating router.
JP 2004-253968 A

  The conventional system is based on the premise that the content provider and the network provider are the same provider, and there is no problem even if network information called user location information is registered in the customer data server.

  However, when the content provider and the network provider are different providers, the user accommodation router is in the network provider, and the customer data server is in the content provider, the network configuration information called user location information is used as the content provider that is another provider. And registering in the customer data server has a problem in network security.

  Furthermore, in the conventional system, even when accounting information used for generating billing information is distributed, it is difficult to pass the accounting information collected by the user accommodating router to the content provider without using the network configuration information as an identifier.

  Therefore, when the content provider and the network provider are different operators, authentication and accounting are performed using an identifier that can be disclosed for security as key information for controlling the user accommodation router without disclosing confidential information. A system that achieves this is required.

  The present invention has been made in view of such problems, and the object of the present invention is to disclose confidential information even when the network provider and the content provider are different providers in multicast distribution. Another object of the present invention is to provide an authentication / billing system for IP multicast distribution that enables user authentication and accounting.

  In order to achieve the above object, a first invention accommodates a content provider IP network including a distribution server that transmits content data as an IP multicast packet, a user device, and a user accommodation for transferring an IP multicast packet to the user device. A content provider AAA server having means for storing a content provider number, means for generating a session number, and means for notifying the network provider of the session number in an IP network connected to an IP network of a network provider including a router And a user accommodation position that is connected to the AAA server of the content provider directly or via the IP network and indicates a user identifier of the user and a accommodation position of the user device used by the user. The network database AAA server having a user database for managing the relationship with the bespoker and means for notifying the user accommodation router of the session number notified from the AAA server of the content provider, and directly to the AAA server of the network provider Alternatively, the content provider's AAA server includes a user accommodating router having means for starting or stopping transfer of a packet of a designated multicast channel identifier for each interface connected via an IP network to which a user device is connected. In this case, the association between the content provider and the content provider number is registered in advance, and the association between the user identifier and the user accommodation location identifier is registered in advance in the AAA server of the network provider, so that the user accommodation In the interface to which the user apparatus is connected in advance, transfer is set to stop for all multicast channel identifiers in advance, and the user apparatus includes at least a user identifier and a multicast channel identifier for the AAA server of the content provider. When the authentication request is transmitted and the AAA server of the content provider permits the authentication request, a session number composed of the content provider number and a number that does not overlap at the same time in the content provider is generated, and the network provider A distribution request including at least a user identifier, a session number, and a multicast channel identifier is transmitted to the AAA server of the network provider, and the AAA server of the network provider distributes it from the AAA server of the content provider. When a communication request is received, a user database is searched based on the user identifier, a user accommodation location identifier in which the user device of the user identifier is accommodated is obtained, and the user accommodation router indicated by the obtained user accommodation location identifier This is characterized in that multicast channel identifier delivery setting is performed for the interface.

  According to a second aspect, in the first aspect, the AAA server of the network provider manages the association between the content provider number and the multicast channel identifier of the multicast channel distributed by the content provider to which the content provider number is assigned. A channel database that manages the association between the database or the IP address of the content provider's AAA server and the multicast channel identifier of the multicast channel distributed by the content provider that owns the content provider's AAA server, from the content provider's AAA server When the distribution request is received, the content provider number included in the distribution request, or the AAA server I of the content provider Address, if association between the multicast channel identifier is present in the channel database, and discards the delivery request.

  According to a third aspect of the present invention, there is provided an IP network of a content provider including a distribution server that transmits content data as an IP multicast packet, and an IP of a network provider including a user accommodating router that accommodates a user device and transfers the IP multicast packet to the user device. In an IP network to which the network is connected, the content provider's AAA server having means for storing a session number, and the content provider's AAA server are connected directly or via the IP network. A user database that manages the relationship with the user accommodation position identifier indicating the accommodation position of the user device to be used, and the content provider identified by the content provider number and the content provider number A network provider AAA server having a content provider database for managing the IP address of the AAA server of Ida, a means for generating a session number, and a means for notifying the session number to the user accommodating router and the AAA server of the content provider; A user accommodating router having means for starting or stopping forwarding of a packet of a designated multicast channel identifier for each interface to which a user apparatus is connected, directly or via an IP network. In the AAA server of the network provider, the association between the user identifier and the user accommodation location identifier is registered in advance, and the user accommodation router is connected in advance to the interface to which the user device is connected. The transfer stop setting is set for all the multicast channel identifiers, and the user apparatus transmits an authentication request including at least the user identifier and the multicast channel identifier to the AAA server of the network provider, and the AAA of the network provider that has received the authentication request. The server generates a number that does not overlap at the same time as the session number, acquires the IP address of the content provider's AAA server from the content provider database, forwards the authentication request, and receives the session number and the user with the authentication request If the content provider's AAA server that received the authentication request associates and authenticates the authentication, it sends an authentication permission response including at least the session number to the network provider's AAA server. When the AAA server of the network provider receives an authentication permission response from the AAA server of the content provider, the user who searches the user database based on the user identifier associated with the session number and accommodates the user device having the user identifier The accommodation location identifier is acquired, and the multicast channel identifier is set to be distributed to the interface of the user accommodation router indicated by the acquired user accommodation location identifier.

  According to a fourth aspect of the present invention, there is provided an IP network of a content provider including a distribution server that transmits content data as an IP multicast packet, and an IP of a network provider including a user accommodating router that accommodates a user device and transfers the IP multicast packet to the user device. In an IP network connected to a network, the content provider's AAA server having means for storing a session number and the content provider's AAA server are connected directly or via the IP network. A content provider database that manages the IP address of the AAA server of the identified content provider, a means for generating a session number, and a session number A network provider's AAA server having means for notifying the user accommodating router and the content provider's AAA server, and an interface connected to the network provider's AAA server directly or via the IP network, and connected to the user device. A user accommodation router having means for starting or stopping transfer of a packet of a designated multicast channel identifier, and in the AAA server of the network provider, the association between the user identifier and the user accommodation location identifier is registered in advance, and the user In the accommodating router, the transfer stop setting is set for all multicast channel identifiers in advance on the interface to which the user equipment is connected, and the address of the AAA server of the connected network provider is registered. The user apparatus transmits an authentication request including at least a user identifier and a multicast channel identifier to the user accommodating router, and the user accommodating router that has received the authentication request transmits at least the user identifier and the multicast included in the authentication request. The authentication request including the channel identifier and the user accommodation location identifier of the interface that has received the authentication request is transferred to the AAA server of the network provider, and the AAA server of the network provider that has received the authentication request does not overlap at the same time as the session number. If the authentication request including at least the user identifier and the multicast channel identifier is transferred to the content provider's AAA server, and the content provider's AAA server that received the authentication request permits authentication, the Authentication information received from the user accommodating router when the network provider's AAA server transmits an authentication permission response including at least the session number to the network provider's AAA server and the network provider's AAA server receives the authentication permission response from the content provider's AAA server. The multicast channel identifier is set to be distributed to the interface of the user accommodating router indicated by the user accommodating position identifier included in the network.

  According to a fifth aspect, in the fourth aspect, when the user accommodating router has a cache for storing the distribution setting and receives the distribution setting request from the AAA of the network provider, the contents of the distribution setting request are stored. In addition, when an authentication request is received from a user apparatus, the cache is referred to, and if there is a match, multicast channel identifier distribution setting is performed for the interface of the user accommodating router.

  According to a sixth invention, in the third to fifth inventions, when the AAA server of the network provider includes a cache for storing the authentication permission response and receives the authentication permission response from the content provider AAA, the authentication permission response is sent. Stored, when an authentication request is received from a user device or a user accommodating router, the cache is referred to, and if there is a match, multicast channel identifier delivery setting is performed for the interface of the user accommodating router. And

  According to a seventh invention, in the first to sixth inventions, the user accommodation router stores the session number notified from the AAA server of the network provider, and sets the distribution start time and the distribution end time for each session number to the AAA of the network provider. Means for notifying the server, wherein the AAA server of the content provider comprises a first accounting database for recording the session number, user identifier, multicast channel identifier, distribution start time, and distribution end time, and the network provider's AAA server The content provider database that manages the content provider number and the IP address of the AAA server of the content provider identified by the content provider number, the session number, the user identifier, and the multicast channel identifier A second accounting database for recording a child, a distribution start time and a distribution end time, and the user accommodating router starts to transfer an IP multicast packet to the user device of the user identifier notified from the AAA server of the network provider The session number, the multicast channel identifier, and the delivery start time are notified to the AAA server of the network provider. When the IP multicast packet is stopped, the session number, the multicast channel identifier, and the delivery end time are The AAA server of the network provider notifies the AAA server of the network provider, and the AAA server of the network provider accounts the session number, multicast channel identifier, distribution start time, and distribution end time notified from the user accommodating router. The network provider AAA server acquires the IP address of the content provider AAA server from the content provider database, and the user identifier, multicast channel identifier, distribution start time, and distribution recorded in the second accounting database. The AAA server of the content provider is notified of the end time, and the AAA server of the content provider sends the user identifier, the multicast channel identifier, the distribution start time, and the distribution end time notified from the AAA server of the network provider to the first accounting database. It is characterized by recording.

  According to the present invention, in multicast distribution, even when the network provider and the content provider are different operators, user authentication and accounting can be performed without disclosing confidential information. The accounting data stored in the content provider is effective for use as data for charging the content viewing fee for the user. The accounting data stored in the network provider is effective for use as data for charging the network usage fee for the content provider.

  Next, embodiments of the present invention will be described with reference to the drawings. The authentication / billing system for IP multicast distribution according to the present invention comprises a user device, an IP network of a network provider, and an IP network of a content provider. A plurality of content provider IP networks may be connected to the IP network of the network provider.

  A first embodiment of the present invention will be described with reference to a network configuration example in FIG. 1, a user database configuration example in FIG. 2, and an operation example in FIG. The network configuration example illustrated in FIG. 1 includes user apparatuses 10-1 to 10-4, a network provider IP network 20, and content provider IP networks 30-1 and 30-2. In the IP network 30-1, a content provider AAA (Authentication, Authorization and Accounting) server (hereinafter referred to as CP-AAA server) 31-1 for authenticating a user authentication request is installed. In the IP network 30-2, A CP-AAA server 31-2 for authenticating a user authentication request is installed. The IP network 20 accommodates user devices 10-1 to 10-4, and user accommodation routers 22-1, 22-2 for transferring IP multicast packets to the user devices, and CP-AAA servers 31-1, 31-. 2, a network provider AAA server (hereinafter referred to as NP-AAA server) 21 that controls the user accommodating routers 22-1 and 22-2 is installed. The user accommodating routers 22-1 and 22-2 are connected to the NP-AAA server 21 directly or via an IP network, and the NP-AAA server 21 is connected to the CP-AAA servers 31-1 and 31-2 directly or Connected via IP network.

  In addition, a distribution server that transmits content data as IP multicast packets is installed in the IP networks 30-1 and 30-2 of the content provider, and a plurality of relay routers are installed in the IP network 20 of the network provider. The description of the present invention is omitted because it is unnecessary.

  The CP-AAA servers 31-1, 31-2 store the content provider number (CPID), generate the session number (SID), and notify the network provider's NP-AAA server 21 of the SID. The association between the content provider and the CPID is registered in advance.

  The NP-AAA server 21 includes a user database that manages the relationship between a user identifier (UID) of a user and a user accommodation location identifier (IFID) indicating the accommodation location of the user device used by the user, and CP- A means for notifying the user accommodating routers 22-1 and 22-2 of the SID notified from the AAA server is provided. FIG. 2 shows a configuration example of the user database. The user database includes a user identifier (UID) and a user accommodation location identifier (IFID). In general, since the user accommodation location is identified by the user accommodation router and the interface in the user accommodation router, the IFID is considered to be composed of, for example, the IP address of the user accommodation router and the interface number.

  The user accommodating routers 22-1 and 22-2 include means for starting or stopping transfer of a packet with a designated multicast channel identifier (CHID) for each interface to which the user devices 10-1 to 10-4 are connected. .

  Next, the operation example of Example 1 is demonstrated using FIG. It is conceivable that authentication information such as a UID and a password for authenticating a user is registered in advance in the CP-AAA server. Also, the association between the UID and the IFID in which the user device is accommodated is registered in the user database of the NP-AAA server. Also, in the user accommodation router serving as the edge router, the multicast transfer setting is set to the transfer stop setting for all CHIDs by default. As a method for setting and canceling the multicast transfer setting, a method for setting and deleting a static route and a method for transmitting and blocking a multicast control packet can be considered.

  When the user wishes to receive a multicast channel, the user apparatus transmits an authentication request including a UID, a multicast channel identifier (CHID), and authentication information to the CP-AAA server. In multicast control, generally, only the IP multicast address is designated as the multicast channel identifier (*, G), or the combination of the IP address and IP multicast address of the distribution server is designated (S, G). Conceivable.

  The CP-AAA server that has received the authentication request refers to the user authentication information and determines whether authentication is possible. When authentication is permitted, a session number (SID) is generated. As the SID, a method of combining a content provider number (CPID) assigned in advance by a network provider and a numerical value generated so as not to overlap with the in-use SID can be considered. The CP-AAA server that generated the SID transmits a distribution request including the SID, UID, and CHID to the NP-AAA server.

  Next, the NP-AAA server that has received the distribution request searches the user database based on the UID included in the distribution request and acquires the IFID. The NP-AAA server that has acquired the IFID performs CHID transfer setting for the interface indicated by the interface number of the user accommodating router indicated by the IP address in the IFID.

  At this time, the SID may be notified in anticipation of a response from the user accommodating router. In this case, the user accommodating router that has performed the CHID transfer setting may use a SID to return a transfer setting success or transfer setting failure response to the NP-AAA server. Further, the NP-AAA server that has received the response may transfer the response to the CP-AAA server. As a result, when the transfer setting fails, the CP-AAA server may immediately delete the invalid SID.

  The present invention identifies individual sessions that control the user-accommodating router using a common session number between the content provider and the network provider. In this case, when the user directly requests access to the content provider from the user device, the content provider may generate a session number as described above. Furthermore, in a configuration in which a plurality of content providers are connected to the network provider, when the content provider generates a session number, there is a possibility that the session numbers generated by the plurality of content providers may be duplicated in the network provider. By defining the provider identifier and the session number being a combination of the content provider identifier and the numerical value generated by the content provider, the above-described duplication can be prevented.

  A second embodiment of the present invention will be described with reference to the configuration example of the channel database shown in FIGS. 4 and 5 and the operation example shown in FIG. The network configuration example and the user database configuration example are the same as those in the first embodiment.

  The second embodiment is different from the first embodiment in that a channel database is provided in the NP-AAA server. As shown in FIG. 4, the channel database includes a multicast channel identifier (CHID) and a content provider number (CPID), and the network provider sends the CPID and the CHID of the multicast channel distributed by the content provider to which the CPID is assigned. Register the association with. Alternatively, as shown in FIG. 5, the channel database is composed of CHID and CP-AAA server information such as the IP address and server certificate of the CP-AAA server. It is also conceivable to register the association with the CHID of the multicast channel distributed by the content provider who owns the CP-AAA server.

  The operation example of the second embodiment is the same as that of the first embodiment until the CP-AAA server authenticates the user and transmits a distribution request to the NP-AAA server. However, the NP-AAA server that has received the distribution request searches the channel database and confirms whether or not the distribution request can be executed for the multicast channel of CHID included in the distribution request from the transmission source content provider. This is different from the first embodiment.

  As a method for confirming whether or not the distribution request can be executed, the CP-AAA server includes the CPID in the distribution request, and the combination of CHID and CPID included in the distribution request is registered in the channel database. A method for confirming whether or not a combination of the transmission source IP address of the packet of the distribution request and the CHID included in the distribution request is registered in the channel database, and the CP-AAA server A method is conceivable in which a server certificate is included in the distribution request and the NP-AAA server confirms the server certificate.

  When receiving a distribution request from the CP-AAA server, the NP-AAA server discards the distribution request if the association between the CPID and the CHID included in the distribution request does not exist in the channel database.

  In the case where the content provider and the network provider are different, in order to prevent an unauthorized content provider from performing unauthorized control on the network provider, as described above, in the NP-AAA server, in the channel database, for each content provider. It is effective to register a multicast channel identifier that may be permitted for authentication and confirm a distribution request from a content provider.

  A third embodiment of the present invention will be described with reference to the configuration example of the content provider database in FIG. 7 and the operation examples in FIGS. The network configuration example and the user database configuration example are the same as those in the first embodiment. In the third embodiment, when a user desires to receive a multicast channel, the user apparatus transmits an authentication request to the NP-AAA server instead of the CP-AAA server, and the NP-AAA server sends an appropriate authentication request. The transfer destination CP-AAA server is determined and transferred, which is different from the first and second embodiments.

  The NP-AAA server determines the transfer destination CP-AAA server by referring to the channel database and acquiring the IP address of the CP-AAA server from the CHID included in the authentication request, or authentication from the user device A method of explicitly including the CPID in the request and referring to the content provider database provided in the NP-AAA server shown in FIG. 7 and acquiring the IP address of the CP-AAA server from the CPID is conceivable.

  The CP-AAA server includes means for storing a session number (SID), and the NP-AAA server includes a user identifier (UID) of a user and a user accommodation location identifier (a user accommodation location identifier indicating the accommodation location of a user device used by the user). A content database that manages the relationship between the CPID and the IP address of the CP-AAA server of the content provider identified by the CPID, a means for generating a SID, And a means for notifying the user accommodating router and the CP-AAA server of the SID.

  The user accommodating router includes means for starting or stopping transfer of a packet of a designated multicast channel identifier (CHID) for each interface to which the user apparatus is connected.

  Next, an operation example of the third embodiment will be described with reference to FIG. In the user database of the NP-AAA server, the association between the UID and the IFID is registered in advance, and the user accommodating router sets transfer stop for all the CHIDs in advance in the interface to which the user apparatus is connected.

  The user transmits an authentication request including at least a UID and a CHID from the user device to the NP-AAA server, and the NP-AAA server that has received the authentication request generates a SID and creates a CP from the content provider database. -Obtain the IP address of the AAA server and forward the authentication request to the CP-AAA server.

  When the CP-AAA server that has received the authentication request permits the authentication, the CP-AAA server transmits an authentication permission response including the SID, UID, and CHID to the NP-AAA server. The NP-AAA server receives the authentication request from the CP-AAA server. When the authentication permission response is received, the user database is searched based on the UID associated with the SID, the IFID in which the user device of the UID is accommodated, and the NP-AAA server includes the acquired IFID. The CHID distribution setting is performed for the interface of the indicated user accommodating router.

  In addition, the SID is generated not by the CP-AAA server but by the NP-AAA server, and is different from the first and second embodiments. As a method of generating the SID and notifying the CP-AAA server, when transmitting the authentication request to the CP-AAA server, a method of generating the SID and including the SID in the authentication request, as shown in FIG. A method is conceivable in which, when the NP-AAA server receives an authentication permission for the authentication request, an SID is generated and notified to the CP-AAA server. In this case, as shown in FIG. 8, when generating an SID at the time of authentication request transfer, if the authentication fails, the NP-AAA server may delete the SID as shown in FIG. In addition, considering the case where the content provider connects to a plurality of network providers, the SID may include a network provider identifier. Considering that the network provider installs a plurality of NP-AAA servers, it is also possible to include the NP-AAA server identifier such as the IP address of the NP-AAA server in the SID.

  As a means for preventing an unauthorized content provider from performing unauthorized control on the network provider, as described above, the NP-AAA server centrally receives access requests from user devices, and sends them to an appropriate content provider. A method of sorting and transferring and trusting only the response to the transfer is also conceivable.

  A fourth embodiment of the present invention will be described using the operation example of FIG. The network configuration example and the user database configuration example are the same as those in the first embodiment. In the fourth embodiment, when the user wishes to receive a multicast channel, the user apparatus transmits an authentication request to the user accommodating router instead of the NP-AAA server, and the user accommodating router forwards the request to the NP-AAA server. The NP-AAA server is different from the third embodiment in that an appropriate authentication request transfer destination CP-AAA server is determined and transferred.

  The CP-AAA server includes means for storing a session number (SID), and the NP-AAA server includes a user identifier (UID) of a user and a user accommodation location identifier (ID) indicating the accommodation location of the user device used by the user. A content database that manages the relationship between the user database that manages the relationship between the IFID and the IP address of the CP-AAA server of the content provider that is identified by the CPID, and means for generating the SID, Means for notifying the SID to the user accommodating router and the CP-AAA server.

  The user accommodating router includes means for starting or stopping transfer of a packet of a designated multicast channel identifier (CHID) for each interface to which the user apparatus is connected.

  Next, the operation example of Example 4 is demonstrated using FIG. In the user database of the NP-AAA server, the association between the UID and the IFID is registered in advance, and the user accommodating router sets the transfer stop for all the CHIDs in advance in the interface to which the user apparatus is connected, and Register the address of the NP-AAA server to be connected.

  The user transmits an authentication request including at least UID and CHID from the user device to the user accommodating router, and the user accommodating router that has received the authentication request receives at least the UID and CHID included in the authentication request and the authentication request. The authentication request including the IFID of the interface that has been transferred is transferred to the NP-AAA server, and the NP-AAA server that has received the authentication request generates an SID and transfers the authentication request including at least the UID and CHID to the CP-AAA server. . In addition, considering the case where the content provider connects to a plurality of network providers, the SID may include a network provider identifier. Considering that the network provider installs a plurality of NP-AAA servers, it is also possible to include the NP-AAA server identifier such as the IP address of the NP-AAA server in the SID.

  When the CP-AAA server that has received the authentication request permits authentication, the CP-AAA server transmits an authentication permission response including at least the SID to the NP-AAA server, and the NP-AAA server sends an authentication permission response from the CP-AAA server. When received, the CHID distribution setting is performed for the interface of the user accommodation router indicated by the IFID included in the authentication information received from the user accommodation router.

  As described above, the user accommodating router centrally receives the access request from the user device and transfers it to the NP-AAA server, so that the NP-AAA server can receive the interface of the user accommodating router from which the access request has arrived. From the information, the legitimacy of the user can be determined.

  A fifth embodiment of the present invention will be described using the cache configuration example of FIG. 12 and the operation example of FIG. In the fifth embodiment, the user accommodating router includes a cache for storing the contents of the distribution request, and the cache included in the user accommodating router includes a UID, a CHID, an interface number, and an expiration date as shown in FIG. .

  In the operation example of the fifth embodiment, when the user accommodating router receives the distribution request from the NP-AAA server in the operation example of the fourth embodiment, the contents of the distribution request are cached. Thereafter, as shown in the operation example of FIG. 13, when an authentication request is received from the user device, it is compared with the contents of the cache, and if the same contents are stored in the cache, the authentication request is transferred to the NP-AAA server. Without setting the CHID distribution setting to the interface of the user accommodation router.

  At this time, as the items to be compared, the interface number that received the authentication request, the interface number stored in the cache, the UID and CHID included in the authentication request, and the UID and CHID stored in the cache can be considered. .

  In addition, when the user accommodation router starts a new distribution by the cache, it is possible to notify the NP-AAA server, and the NP-AAA server generates a SID and notifies the user accommodation router and the CP-AAA server. .

  It is also conceivable that the CP-AAA server explicitly specifies the cache expiration date, and the user-accommodating router validates the contents of the cache within the range of the expiration date. Furthermore, when the content provider does not want the network provider to perform authentication by cache, it may be possible to describe a predetermined value indicating cache invalidity in the expiration date. Furthermore, when invalidating the cache data within the cache data expiration date, the content provider may transmit a message requesting cache invalidation to the network provider.

  As described above, when the user accommodating router relays the access request, the user accommodating router caches the authentication permission information, so that the connection delay can be shortened from the viewpoint of the user, and the NP-AAA server and CP -From the AAA server perspective, congestion can be reduced.

  A sixth embodiment of the present invention will be described using the cache configuration example of FIG. 14 and the operation examples of FIGS. In the sixth embodiment, the NP-AAA server includes a cache that stores the contents of the distribution request, and the cache included in the NP-AAA server includes a UID, CHID, IFID, and an expiration date as illustrated in FIG. The

  In the operation example of the sixth embodiment, when the NP-AAA server receives a distribution request from the CP-AAA server in the operation examples of the first to third embodiments, the contents of the distribution request are cached. Thereafter, as shown in the operation example of FIG. 15, when the NP-AAA server receives the authentication request from the user device, if the same contents exist in the cache, the authentication request is not transferred to the CP-AAA server. Set CHID distribution for the interface of the user accommodation router.

  Alternatively, as shown in the operation example of FIG. 16, in a system in which the user accommodation router transfers an authentication request to the NP-AAA server, when the NP-AAA server receives the authentication request from the user accommodation router, it is the same as the cache. If the contents exist, the CHID distribution setting is made to the interface of the user accommodation router without transferring the authentication request to the CP-AAA server.

  Further, as shown in the operation example of FIG. 17, the user accommodating router is also provided with the cache described in the fifth embodiment, and when the user accommodating router receives the authentication request from the user device, the cache is confirmed and the match is confirmed. If not, it is also conceivable to transfer the authentication request to the NP-AAA server and check the cache with the NP-AAA server.

  When the NP-AAA server performs a new distribution setting using a cache, it may be possible to generate an SID and notify the user accommodation router and the CP-AAA server.

  It is also conceivable that the CP-AAA server explicitly specifies the expiration date of the cache, and the user accommodating router validates the contents of the cache within the range of the expiration date. Furthermore, when the content provider does not want the network provider to perform authentication by caching, it may be possible to describe a predetermined value for the expiration date.

  As described above, when the NP-AAA server relays the access request, the NP-AAA server caches the authentication permission information, so that the connection delay can be shortened from the viewpoint of the user and the CP-AAA server. From the point of view, congestion can be reduced.

  A seventh embodiment of the present invention will be described using the accounting database configuration example of FIG. 18 and the operation examples of FIGS. 19 and 20. The network configuration example and the user database configuration example are the same as those in the first embodiment. In the seventh embodiment, it is assumed that the authentication is completed and the IP multicast packet distribution is started according to the first to sixth embodiments.

  The user accommodation router stores a SID notified from the NP-AAA server, and includes means for notifying the NP-AAA server of the distribution start time and the distribution end time for each SID. The NP-AAA server includes a content provider database that manages the relationship between the CPID and the IP address of the CP-AAA server of the content provider identified by the CPID, a SID, a UID, a CHID, a distribution start time, and a distribution end time. Provide accounting database to record. The CP-AAA server includes an accounting database that records SID, UID, CHID, distribution start time, and distribution end time. FIG. 18 shows a configuration example of the accounting database, and the accounting database is composed of SID, UID, CHID, start time, and end time.

  Next, an operation example of the seventh embodiment will be described with reference to FIG. The user accommodating router transmits a distribution start notification to the NP-AAA server when the IP multicast packet starts to be transferred to the user device having the UID notified from the NP-AAA server. The delivery start notification includes at least the SID, the CHID, and the delivery start time. The NP-AAA server that has received the distribution start notification stores the SID, CHID, and distribution start time in the accounting database of the NP-AAA server.

  Thereafter, the user accommodating router transmits a distribution stop notification to the NP-AAA server when the distribution of the IP multicast packet is stopped due to the distribution stop request from the user device or the end of the multicast content. The delivery start notification includes at least the SID, the CHID, and the delivery stop time. The NP-AAA server that has received the distribution stop notification additionally stores the distribution end time in the item of the same SID in the accounting database of the NP-AAA server.

  The NP-AAA server searches the content provider database, acquires the IP address of the CP-AAA server that transmits accounting information (UID, CHID, distribution start time, and distribution end time) from the SID, and sends it to the CP-AAA server. The accounting information recorded in the accounting database of the NP-AAA server is notified.

  As a trigger for the NP-AAA server to notify the CP-AAA server of accounting information, a method for setting a predetermined time, a method for setting a predetermined time period, or a request from the CP-AAA server is used. Conceivable.

  The CP-AAA server records the UID, CHID, distribution start time, and distribution end time notified from the NP-AAA server in the accounting database of the CP-AAA server.

  Alternatively, as shown in the operation example of the seventh embodiment in FIG. 20, when the NP-AAA server receives the distribution start notification from the user accommodation router, the NP-AAA server transfers the distribution start notification to the CP-AAA server and distributes it from the user accommodation router. When the stop notification is received, the delivery stop notification is transferred to the CP-AAA server, and the CP-AAA server associates the delivery start notification with the delivery stop notification by the SID to create accounting data.

  As described above, since the user session can be identified using the session number that can be disclosed as security as key information for controlling the user accommodating router, even if the content provider and the network provider are different operators, Accounting can be performed using numbers, and accurate accounting can be realized even when multicast is not recognized by the distribution server as to the start and end of distribution to users, such as multicast.

It is an example of a network structure of Example 1 of this invention. It is an example of a user database structure of Example 1 of this invention. It is an operation example of Example 1 of the present invention. It is an example of a channel database structure of Example 2 of this invention. It is an example of a channel database structure of Example 2 of this invention. It is an operation example of Example 2 of the present invention. It is a content provider database structural example of NP-AAA server of Example 3 of this invention. It is an operation example of Example 3 of the present invention. It is an operation example of Example 3 of the present invention. It is an operation example of Example 3 of the present invention. It is an operation example of Example 4 of the present invention. It is a cache structural example of Example 5 of this invention. It is an operation example of Example 5 of the present invention. It is a cache structural example of Example 6 of this invention. It is an operation example of Example 6 of the present invention. It is an operation example of Example 6 of the present invention. It is an operation example of Example 6 of the present invention. It is an example of an accounting database structure of Example 7 of this invention. It is an operation example of Example 7 of the present invention. It is an operation example of Example 7 of the present invention.

Explanation of symbols

10-1 to 10-4 User device 20 IP network of network provider 21 NP-AAA server 22-1 and 22-2 User accommodating router 30-1 and 30-2 IP network of content provider 31-1 and 31-2 CP -AAA server

Claims (7)

An IP network of a content provider including a distribution server that transmits content data as an IP multicast packet is connected to an IP network of a network provider including a user accommodating router that accommodates a user device and transfers the IP multicast packet to the user device. In an IP network,
A content provider AAA server having means for storing a content provider number; means for generating a session number; and means for notifying the network provider of the session number;
A user database that is connected to the AAA server of the content provider directly or via an IP network and manages the relationship between the user identifier of the user and the user accommodation location identifier indicating the accommodation location of the user device used by the user; A network provider's AAA server having means for notifying the user accommodation router of the session number notified from the content provider's AAA server;
A user accommodating router connected to the AAA server of the network provider directly or via an IP network and having means for starting or stopping forwarding of a packet of a designated multicast channel identifier for each interface to which a user device is connected; Prepared,
The association between the content provider and the content provider number is registered in advance in the AAA server of the content provider,
In the network provider's AAA server, the association between the user identifier and the user accommodation location identifier is registered in advance,
In the user accommodating router, in the interface to which the user device is connected in advance, the transfer stop setting is set for all multicast channel identifiers,
The user device transmits an authentication request including at least a user identifier and a multicast channel identifier to the AAA server of the content provider,
When the AAA server of the content provider permits the authentication request, the AAA server of the content provider generates a session number composed of the content provider number and a number that does not overlap at the same time at the content provider, Sending a delivery request including at least a user identifier, a session number and a multicast channel identifier;
When receiving a distribution request from the content provider's AAA server, the network provider's AAA server searches the user database based on the user identifier and obtains a user accommodation location identifier in which the user device of the user identifier is accommodated. An IP multicast distribution authentication charging system, wherein distribution setting of a multicast channel identifier is performed for an interface of a user accommodation router indicated by the acquired user accommodation location identifier. The authentication / billing system for IP multicast delivery according to claim 1,
The AAA server of the network provider is a channel database that manages the association between the content provider number and the multicast channel identifier of the multicast channel distributed by the content provider to which the content provider number is assigned, or the IP address of the content provider's AAA server And a channel database for managing the association between the multicast channel identifiers of the multicast channels distributed by the content provider that owns the content provider's AAA server,
When the distribution request is received from the content provider's AAA server, if the association between the content provider number included in the distribution request or the IP address of the content provider's AAA server and the multicast channel identifier does not exist in the channel database, An authentication charging system for IP multicast distribution, wherein the distribution request is discarded. An IP network of a content provider including a distribution server that transmits content data as an IP multicast packet is connected to an IP network of a network provider including a user accommodating router that accommodates a user device and transfers the IP multicast packet to the user device. In an IP network,
An AAA server of the content provider having means for storing the session number;
A user database that is connected to the AAA server of the content provider directly or via an IP network and manages the relationship between the user identifier of the user and the user accommodation location identifier indicating the accommodation location of the user device used by the user; A content provider database that manages the content provider number and the IP address of the AAA server of the content provider identified by the content provider number, means for generating a session number, and notifies the user accommodating router and the AAA server of the content provider of the session number An AAA server of a network provider having means for:
A user accommodating router connected to the AAA server of the network provider directly or via an IP network and having means for starting or stopping forwarding of a packet of a designated multicast channel identifier for each interface to which a user device is connected; Prepared,
In the network provider's AAA server, the association between the user identifier and the user accommodation location identifier is registered in advance,
In the user accommodating router, in the interface to which the user device is connected in advance, the transfer stop setting is set for all multicast channel identifiers,
The user apparatus transmits an authentication request including at least a user identifier and a multicast channel identifier to the AAA server of the network provider,
The AAA server of the network provider that has received the authentication request generates a number that does not overlap at the same time as the session number, acquires the IP address of the AAA server of the content provider from the content provider database, transfers the authentication request,
Store the session number and the user identifier of the user who requested authentication in association with each other,
The AAA server of the content provider that has received the authentication request transmits an authentication permission response including at least the session number to the AAA server of the network provider when authentication is permitted.
When the AAA server of the network provider receives an authentication permission response from the AAA server of the content provider, it searches the user database based on the user identifier associated with the session number, and the user in which the user device with the user identifier is accommodated An authentication charging system for IP multicast distribution, characterized in that an accommodation location identifier is acquired and a multicast channel identifier is set for delivery to an interface of a user accommodation router indicated by the acquired user accommodation location identifier. An IP network of a content provider including a distribution server that transmits content data as an IP multicast packet is connected to an IP network of a network provider including a user accommodating router that accommodates a user device and transfers the IP multicast packet to the user device. In an IP network,
An AAA server of the content provider having means for storing the session number;
Connected directly to the content provider's AAA server or via an IP network,
Content provider database that manages the content provider number and the IP address of the content provider's AAA server identified by the content provider number, means for generating a session number, and notifies the user accommodating router and the content provider's AAA server of the session number An AAA server of a network provider having means;
A user accommodating router connected to the AAA server of the network provider directly or via an IP network and having means for starting or stopping forwarding of a packet of a designated multicast channel identifier for each interface to which a user device is connected; Prepared,
In the network provider's AAA server, the association between the user identifier and the user accommodation location identifier is registered in advance,
In the user accommodating router, the transfer stop setting is set for all the multicast channel identifiers in the interface to which the user device is connected in advance, and the address of the AAA server of the network provider to be connected is registered,
The user apparatus transmits an authentication request including at least a user identifier and a multicast channel identifier to the user accommodating router,
The user accommodating router that has received the authentication request transfers the authentication request including at least the user identifier and the multicast channel identifier included in the authentication request and the user accommodating position identifier of the interface that has received the authentication request to the AAA server of the network provider,
The AAA server of the network provider that has received the authentication request generates a number that does not overlap at the same time as the session number, transfers the authentication request including at least a user identifier and a multicast channel identifier to the AAA server of the content provider,
The AAA server of the content provider that has received the authentication request transmits an authentication permission response including at least the session number to the AAA server of the network provider when authentication is permitted.
When the AAA server of the network provider receives an authentication permission response from the AAA server of the content provider, the AAA server of the network provider sends a multicast channel to the interface of the user accommodation router indicated by the user accommodation location identifier included in the authentication information received from the user accommodation router. An authentication / billing system for IP multicast distribution characterized in that identifier distribution is set. The authentication / billing system for IP multicast distribution according to claim 4,
The user accommodating router includes a cache for storing distribution settings, and stores the contents of the distribution setting request when receiving the distribution setting request from the AAA of the network provider,
When an authentication request is received from a user apparatus, the multicast is referred to the cache, and if there is a match, the multicast channel identifier is set to be distributed to the interface of the user accommodating router. Billing system. In the authentication charging system for IP multicast distribution according to any one of claims 3 to 5,
The AAA server of the network provider includes a cache for storing an authentication permission response, and stores the authentication permission response when the authentication permission response is received from the content provider AAA,
IP multicast distribution characterized in that when an authentication request is received from a user device or a user accommodation router, a multicast channel identifier is distributed to the interface of the user accommodation router by referring to the cache and if there is a match. Authentication billing system. The authentication charging system for IP multicast distribution according to any one of claims 1 to 6,
The user-accommodating router includes means for storing the session number notified from the AAA server of the network provider and notifying the AAA server of the network provider of the distribution start time and the distribution end time for each session number,
The AAA server of the content provider includes a first accounting database that records a session number, a user identifier, a multicast channel identifier, a distribution start time, and a distribution end time.
The AAA server of the network provider includes a content provider database that manages the content provider number and the IP address of the AAA server of the content provider identified by the content provider number, a session number, a user identifier, a multicast channel identifier, a distribution start time, A second accounting database for recording the delivery end time;
When the IP multicast packet is started to be transferred to the user device with the user identifier notified from the AAA server of the network provider, the user accommodating router displays the session number, the multicast channel identifier, and the distribution start time with the AAA of the network provider. When the IP multicast packet is stopped, the session number, the multicast channel identifier, and the delivery end time are notified to the network provider's AAA server.
The network provider's AAA server records the session number, multicast channel identifier, distribution start time, and distribution end time notified from the user accommodating router in the accounting database. The network provider's AAA server stores the content provider's AAA server from the content provider database. Obtain the IP address of the AAA server and notify the content provider's AAA server of the user identifier, the multicast channel identifier, the distribution start time, and the distribution end time recorded in the second accounting database;
The AAA server of the content provider records the user identifier, the multicast channel identifier, the distribution start time, and the distribution end time notified from the network provider AAA server in the first accounting database. Billing system.

Images